# Search IPV6 only in Kibana for nginx access log

**URL:** <https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561>\
**Category:** Kibana\
**Tags:** docker\
**Created:** [March 13, 2020, 6:33pm UTC](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561 "2020-03-13T18:33:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Slavik\_Fursov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slavik_fursov/32/48975_2.png) [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\
**Post date:** [March 13, 2020, 6:33pm UTC](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561/1 "2020-03-13T18:33:03Z")

</div>

I have nginx access logs with IPV6 and IPV4 entries.

Is there a way to write KQL (or Lucene), so I find only IPV6 entries in the source.ip field?

Example of entries:

```auto
Mar 13, 2020 @ 11:21:59.000	200	141.8.142.31	noty.propovednik.com
Mar 13, 2020 @ 11:21:58.000	206	2a00:1fa0:4205:610b:0:4e:fb1e:8701	propovednik.com

```

I tried to search for entries, which has ":" in them, but such query fails:

`source.ip: "*:*"`

Error:

```auto
{"type":"illegal_argument_exception","reason":"'*:*' is not an IP string literal."}}}]},"status":400}

```

---

<div class="post-metadata">

**Author:** ![Supermathie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/supermathie/32/44936_2.png) [@Supermathie](https://discuss.elastic.co/u/Supermathie)\
**Post date:** [March 13, 2020, 6:52pm UTC](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561/2 "2020-03-13T18:52:54Z")

</div>

You can use a CIDR search with an IP datatype.

You _might_ expect this to work: `client_ip:"::/0"` but it doesn't, it still shows everything.

But this only shows v6 addresses: `NOT client_ip:"0.0.0.0/0"`

(tested on ES 6.6.2)

---

<div class="post-metadata">

**Author:** ![Slavik\_Fursov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slavik_fursov/32/48975_2.png) [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\
**Post date:** [March 13, 2020, 7:14pm UTC](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561/3 "2020-03-13T19:14:28Z")

</div>

Looks like that doesn't do anything.  
I see both IPV4 and IPV6 with that query:

 ![Screen Shot 2020-03-13 at 12.13.28 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/3/a33127b6cafad9ade29c5356cd7554751e5e0109.jpeg)

Same result with ` NOT client_ip:"0.0.0.0/0"`, too

---

<div class="post-metadata">

**Author:** ![Supermathie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/supermathie/32/44936_2.png) [@Supermathie](https://discuss.elastic.co/u/Supermathie)\
**Post date:** [March 13, 2020, 7:50pm UTC](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561/4 "2020-03-13T19:50:24Z")

</div>

Works for me:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/b/bb1b4c9d43c9dcf05ef1e6ad256bf636c21d5218.png)

this behaviour might be version-dependent, what version of ES are you using?

---

<div class="post-metadata">

**Author:** ![Slavik\_Fursov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slavik_fursov/32/48975_2.png) [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\
**Post date:** [March 13, 2020, 8:04pm UTC](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561/5 "2020-03-13T20:04:54Z")

</div>

It does work!  
My apologies.

I just have field, which is called `source.ip`, not `client_ip`.

I'm using Kibana 7.6.0.

Thank you!

---

<div class="post-metadata">

**Author:** ![Supermathie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/supermathie/32/44936_2.png) [@Supermathie](https://discuss.elastic.co/u/Supermathie)\
**Post date:** [March 13, 2020, 8:18pm UTC](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561/6 "2020-03-13T20:18:56Z")

</div>

> [@Slavik\_Fursov](#):
>
> I just have field, which is called `source.ip` , not `client_ip` .

I hope that facepalm wasn't _too_ hard 😃

Time for the weekend?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2020, 8:19pm UTC](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561/7 "2020-04-10T20:19:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.